Live › vulnerability › CVE-2026-76293
Go to dashboardSplunk Web evaluates user-controlled expressions in Manager XML without restricting the syntax, so a user with the edit_manager_xml capability can run arbitrary operating-system commands. The commands run with the permissions of the account that runs Splunk Enterprise.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running Splunk Enterprise below the fixed versions where some users hold a role with the edit_manager_xml capability. An attacker needs an account with that capability, so instances where only administrators can log in are at lower risk. unknown whether the sources list a default role that includes the capability.
No product ranges from the sources yet.
splunk version and compare it against the fixed releases listed below.edit_manager_xml capability, for example in Settings > Roles or in authorize.conf.10.4.3, 10.2.8, 10.0.11, or 9.4.16, matching your release line.edit_manager_xml capability from roles that do not need it until the upgrade is applied.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
This page as .md · .json · in your agent: get_signal("CVE-2026-76293")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.